Bug 1396568 - Make DocumentFragment::mHost a strong reference (so that ShadowRoot.host doesn't become null)

Tag #1375

4 files changed, 14 insertions, 8 deletions

diff --git a/dom/base/DocumentFragment.cpp b/dom/base/DocumentFragment.cpp
index 3eb2a07908..b3d0d9962d 100644
--- a/dom/base/DocumentFragment.cpp
+++ b/dom/base/DocumentFragment.cpp
@@ -125,6 +125,10 @@ DocumentFragment::Constructor(const GlobalObject& aGlobal,
   return window->GetDoc()->CreateDocumentFragment();
 }
 
+NS_IMPL_CYCLE_COLLECTION_INHERITED(DocumentFragment,
+                                   FragmentOrElement,
+                                   mHost)
+
 // QueryInterface implementation for DocumentFragment
 NS_INTERFACE_MAP_BEGIN(DocumentFragment)
   NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
diff --git a/dom/base/DocumentFragment.h b/dom/base/DocumentFragment.h
index 68a7f0ff47..33d8d4d9d5 100644
--- a/dom/base/DocumentFragment.h
+++ b/dom/base/DocumentFragment.h
@@ -43,6 +43,8 @@ public:
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
+  NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(DocumentFragment,
+                                           FragmentOrElement)
 
   // interface nsIDOMNode
   NS_FORWARD_NSIDOMNODE_TO_NSINODE
@@ -121,12 +123,12 @@ public:
     return nullptr;
   }
 
-  nsIContent* GetHost() const
+  Element* GetHost() const
   {
     return mHost;
   }
 
-  void SetHost(nsIContent* aHost)
+  void SetHost(Element* aHost)
   {
     mHost = aHost;
   }
@@ -145,7 +147,7 @@ protected:
   }
 
   nsresult Clone(mozilla::dom::NodeInfo *aNodeInfo, nsINode **aResult) const override;
-  nsIContent* mHost; // Weak
+  nsCOMPtr<Element> mHost;
 };
 
 } // namespace dom
diff --git a/dom/base/ShadowRoot.cpp b/dom/base/ShadowRoot.cpp
index 831987a96e..51223a8937 100644
--- a/dom/base/ShadowRoot.cpp
+++ b/dom/base/ShadowRoot.cpp
@@ -59,14 +59,14 @@ NS_INTERFACE_MAP_END_INHERITING(DocumentFragment)
 NS_IMPL_ADDREF_INHERITED(ShadowRoot, DocumentFragment)
 NS_IMPL_RELEASE_INHERITED(ShadowRoot, DocumentFragment)
 
-ShadowRoot::ShadowRoot(nsIContent* aContent,
+ShadowRoot::ShadowRoot(Element* aElement,
                        already_AddRefed<mozilla::dom::NodeInfo>&& aNodeInfo,
                        nsXBLPrototypeBinding* aProtoBinding)
-  : DocumentFragment(aNodeInfo), mPoolHost(aContent),
+  : DocumentFragment(aNodeInfo), mPoolHost(aElement),
     mProtoBinding(aProtoBinding), mShadowElement(nullptr),
     mInsertionPointChanged(false), mIsComposedDocParticipant(false)
 {
-  SetHost(aContent);
+  SetHost(aElement);
 
   // Nodes in a shadow tree should never store a value
   // in the subtree root pointer, nodes in the shadow tree
@@ -75,7 +75,7 @@ ShadowRoot::ShadowRoot(nsIContent* aContent,
 
   SetFlags(NODE_IS_IN_SHADOW_TREE);
 
-  ExtendedDOMSlots()->mBindingParent = aContent;
+  ExtendedDOMSlots()->mBindingParent = aElement;
   ExtendedDOMSlots()->mContainingShadow = this;
 
   // Add the ShadowRoot as a mutation observer on the host to watch
diff --git a/dom/base/ShadowRoot.h b/dom/base/ShadowRoot.h
index f840781348..e76e4ab3f3 100644
--- a/dom/base/ShadowRoot.h
+++ b/dom/base/ShadowRoot.h
@@ -42,7 +42,7 @@ public:
   NS_DECL_NSIMUTATIONOBSERVER_CONTENTINSERTED
   NS_DECL_NSIMUTATIONOBSERVER_CONTENTREMOVED
 
-  ShadowRoot(nsIContent* aContent, already_AddRefed<mozilla::dom::NodeInfo>&& aNodeInfo,
+  ShadowRoot(Element* aElement, already_AddRefed<mozilla::dom::NodeInfo>&& aNodeInfo,
              nsXBLPrototypeBinding* aProtoBinding);
 
   void AddToIdTable(Element* aElement, nsIAtom* aId);